Privacy policy

The purpose of this privacy policy is to inform users of the Plumelisse application about the way in which their personal data is collected, used, stored, and protected when using the service.

1. Data controller

The data controller is:
Alexis Choloux
Sole proprietor
Trade name: Ohlalapp
SIREN: 810 293 159
SIRET: 810 293 159 00036
Address: 4 Rue de la Planète Bleue, 79350 Chiché, France
Contact email: contact.ohlalapp@gmail.com

2. Personal data processed

Depending on your use of the application, we may process the following categories of data:

a) Identification and account data

email address
authentication-related information
more specifically, with social login via Google or Facebook / Meta:
- the email address associated with the third-party account,
- the unique identifier provided by that authentication service,
- the profile picture, if transmitted by the provider

When you choose social login, certain authentication data is processed via the relevant provider, in particular your email address, your provider identifier, and, where applicable, your profile picture.

b) Data related to use of the service

projects
chapters
notes
characters
timeline events
text content, images, and other elements you import or create in the application
interface preferences and usage language
account synchronization and usage information

c) Support-related data

content of messages sent to support
possible attachments, including screenshots
history of support exchanges

d) Billing and subscription data

subscription status
type of subscribed plan
technical identifiers linked to Stripe
information necessary to monitor the subscription, renewal, customer portal management, and reconciliation of access rights

Important: full bank card data is not processed directly in Plumelisse or by Ohlalapp. Payments are handled by Stripe, a third-party payment provider.

e) Technical and security data

IP address
technical logs
information about the device, browser, and operating system
data necessary for security, prevention of abuse, and proper functioning of the service

f) Audience measurement data

site and application traffic and usage data collected via Google Analytics, subject to the selected configuration and, where required by law, your consent.

3. Purposes of processing and legal bases

Your personal data is processed for the following purposes:

a) Provision of the service and account management

Purposes:

creation and management of the user account
authentication
access to the application’s features
multi-device synchronization
backup and restoration of content
management of quotas, roles, and access rights

Legal basis:

performance of the contract or pre-contractual measures

b) Subscription and payment management

Purposes:

subscription to Premium plans
billing management
management of the Stripe customer portal
monitoring of payments, renewals, cancellations, and incidents
updating access rights linked to the subscription

Legal basis:

performance of the contract
legal obligations applicable in accounting and tax matters

c) User support and request management

Purposes:

responding to requests sent via the contact form
processing support tickets
tracking exchanges and resolving incidents

Legal basis:

legitimate interest in providing assistance and support for the service
or performance of the contract when the data subject is a customer of the service

d) Security, maintenance, and prevention of abuse

Purposes:

securing the service
prevention of fraud, abusive use, and unauthorized access
technical logging
maintenance, diagnosis, bug fixing, and continuity of the service

Legal basis:

legitimate interest

e) Audience measurement and service improvement

Purposes:

traffic measurement
understanding the use of the website and application
improving ergonomics, performance, and features

Legal basis:

consent, where required
or, only if the tool is configured in a way that benefits from an applicable exemption, under the conditions laid down by the regulations

4. Mandatory or optional nature of data

Certain data is necessary for account creation, access to the service, subscription management, or processing support requests.

Where this data is not provided, certain features or services cannot be delivered.

Other data is optional.

5. Recipients of the data

Personal data is accessible, within the limits of their respective responsibilities, to the following recipients:

Alexis Choloux / Ohlalapp, for operation, administration, assistance, and maintenance of the service;
o2switch, as technical host of the website, application, and associated data;
Stripe, as payment and subscription management provider;
Google Analytics, when activated according to your choices, for audience measurement and analysis of service usage (public pages only);
Google or Facebook / Meta, when you choose to use the social login offered by the service;
administrative or judicial authorities, when required by law.

Personal data is not sold to third parties.

6. Hosting and main processors

The main providers involved in the service are as follows:

o2switch: technical hosting of the website, application, and data;
Stripe: payment processing, subscription management, and access to the billing customer portal;
Google Analytics: audience measurement and usage statistics, when activated according to your choices;
Google and Facebook / Meta: social authentication services, when you choose this login method.

7. Transfers outside the European Union

Certain providers used in connection with the service, in particular Stripe, Google, and potentially Meta, may process or transfer certain personal data outside the European Union, in particular to the United States. Stripe indicates that it may transfer personal data to Stripe, LLC in the United States and to its affiliates and subcontractors in other jurisdictions; Stripe also indicates that it adheres to the EU–US Data Privacy Framework. Google also indicates that it adheres to the EU–US Data Privacy Framework for the relevant entities.

Where such transfers take place, they are governed in accordance with the applicable regulations, in particular by appropriate mechanisms such as the European Commission’s standard contractual clauses or any other recognized valid mechanism.

8. Retention periods

Personal data is kept for no longer than is necessary for the purposes for which it is processed.

As a general rule:

account data: kept for the entire duration of the user account; in the event of account deletion, account data and associated content are deleted from the application as soon as possible, subject to data that must be retained in order to comply with a legal obligation or for the establishment, exercise, or defense of legal claims;
content created in the application: kept for the duration of use of the service, then deleted with the account or at the user’s request, depending on available features;
support tickets: kept as long as they remain relevant for monitoring the support relationship, handling complaints, or evidentiary purposes;
screenshots and support attachments: deleted once the ticket has been handled or closed, unless there is a particular need to retain them due to litigation or a legal obligation;
subscription and billing-related data: kept for the period necessary to manage the subscription, then for the retention periods required by legal obligations, in particular accounting and tax obligations;
technical data strictly necessary for operation and security: kept for a limited period proportionate to its purpose.

9. Security

We implement appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

However, as no system offers absolute security, we cannot guarantee perfect security in all circumstances.

10. Payment data

Payments are processed by Stripe. Plumelisse does not have access to full bank card numbers.

Information relating to payment, subscription, renewal, cancellation, and subscription status may, however, be processed via the identifiers and metadata necessary to manage your access to the service.

11. Cookies and trackers

The website and application may use cookies or other trackers:

strictly necessary for the operation of the service
intended for audience measurement
linked, where applicable, to certain third-party services

In accordance with the applicable rules, certain trackers require your prior consent before being placed or read. The CNIL reminds that consent is required for many cookies and trackers, while certain trackers strictly necessary for operation or certain audience measurement tools configured under specific conditions may be exempt.

Important regarding Google Analytics: the use of Google Analytics must be carefully assessed in light of the applicable rules relating to cookies and data transfers. The CNIL has published specific recommendations on audience measurement tools and associated transfers.

A dedicated cookies policy may specify the categories of trackers used, their purposes, their retention period, and the ways in which your choices are managed.

12. Your rights

In accordance with the applicable regulations, you notably have the following rights:

right of access
right to rectification
right to erasure
right to restriction of processing
right to object
right to portability, where this right applies
right to withdraw your consent at any time, for processing based on consent
right to define instructions relating to the fate of your data after your death, under the conditions provided by French law

You may exercise your rights at the following address: contact.ohlalapp@gmail.com

To request the deletion of your personal data, you may either use the account deletion feature available from your Account page after signing in, or send us a request by email to that same address.

Deleting the account results in the deletion of account data and associated content as soon as possible, subject to data that must be retained in order to comply with a legal obligation or for the establishment, exercise, or defense of legal claims.

Where there is reasonable doubt concerning your identity, proof of identity may be requested.

You also have the right to lodge a complaint with the CNIL.

13. Data entered by users

You are responsible for the content, information, documents, images, and data that you import, write, or store in the application.

You undertake not to use the service to process or distribute unlawful content or personal data in breach of the applicable regulations.

When you enter data concerning third parties into the application, you undertake to have an appropriate legal basis for doing so.

14. Minors

The service is intended for the general public.

If you are a minor, it is your responsibility to ensure that use of the service is authorized by your legal representatives where the applicable regulations so require.

If you believe that a minor has transmitted personal data inappropriately via the service, you may contact us at the following address: contact.ohlalapp@gmail.com

15. Changes to the policy

This privacy policy may be modified at any time in order to take account of legal, regulatory, technical, or functional changes.

The applicable version is the one published on the website or in the application on the date of consultation.

Policy relating to cookies and other trackers

Last updated: 22/04/2026

The purpose of this policy is to inform users of the Plumelisse website and application about the use of cookies and other trackers when browsing.

1. What is a cookie or tracker?

A cookie is a small file placed on or read from your device (computer, smartphone, tablet) when you visit a website or application.

The term “tracker” notably includes cookies, but also other technologies that make it possible to read or write information on your device or to track your browsing.

2. Who places trackers?

Trackers may be placed by:

Ohlalapp, as the service publisher
technical providers acting on behalf of Ohlalapp
certain third-party services integrated into the website or application, such as audience measurement tools or services linked to authentication and payment

3. What types of trackers do we use?

a) Trackers strictly necessary for the operation of the service

We use trackers strictly necessary for the technical operation of the website and application, in particular in order to:

maintain the user session;
ensure authentication;
secure access to the account;
remember your choices regarding consent to cookies and trackers.

These trackers are necessary for the provision of the requested service and do not, in principle, require your prior consent.

b) Audience measurement trackers

We use Google Analytics in order to measure traffic, establish usage statistics, and improve the service.

These trackers are enabled only on public pages (marketing website) and only after your consent, unless a future configuration makes it possible to effectively meet the exemption conditions provided by the applicable regulations.

c) Trackers linked to third-party services

The website or application may integrate third-party services likely to place trackers or access information on your device, in particular:

social authentication services, such as Google or Facebook / Meta
payment or payment session management services, such as Stripe
other technical services necessary for the operation or improvement of the service

Where these trackers are not strictly necessary, they are subject to your prior consent.

4. Legal basis

The use of trackers strictly necessary for operation is based on the legitimate interest of ensuring the proper functioning, security, and provision of the requested service.

The use of trackers subject to consent, in particular certain audience measurement trackers or third-party service trackers, is based on your prior consent. This consent may be withdrawn at any time.

5. Consent

Where required, trackers are placed or read only after your consent has been collected.

You may:

accept all trackers
refuse all non-essential trackers
choose the purposes or categories of trackers you accept

Refusal of non-essential trackers must not prevent access to the website or application, subject to the features that directly depend on the refused trackers. The CNIL also reminds that refusal must be as easy as acceptance.

6. Retention period

The lifetime of trackers is limited to what is necessary for their purpose.

For information purposes:

trackers strictly necessary for the user session: for the duration of the session or, where applicable, for a period not exceeding what is necessary to maintain authentication;
consent preferences: 6 months;
Google Analytics audience measurement trackers: depending on the effective configuration of the tool and your consent choices.

Where required by the applicable regulations, lifetimes and retention periods are limited in accordance with current recommendations, in particular concerning audience measurement.

7. List of trackers used

The list below is intended to be updated according to the tools actually used on the website and in the application.

a) Strictly necessary trackers

user session cookies
authentication cookies
security cookies
cookies recording your consent choices

b) Audience measurement trackers

Google Analytics: audience measurement, usage statistics, service improvement
Status: subject to prior consent, unless configured in a way that satisfies the applicable exemption conditions

c) Trackers potentially linked to third-party services

Google: social login, depending on the features used
Facebook / Meta: social login, depending on the features used
Stripe: payment operation and subscription journey, depending on the modules actually integrated

8. Management of your choices

You may modify your preferences regarding cookies and other trackers at any time via:

the consent management module accessible on the website or in the application
your browser settings, within the limits of their features

Browser settings do not always make it possible to manage all the technologies used; this is why a dedicated consent management tool may be offered.

9. Transfers of data outside the European Union

Where trackers or third-party services involve processing carried out by providers located outside the European Union, in particular in the United States, data transfers may take place.

The CNIL reminds that the use of audience measurement tools or other third-party services may raise specific issues regarding data transfers outside the EU.

For more information on these processing activities, you may consult our Privacy Policy.

10. Contact

For any question relating to this policy or to the use of cookies and other trackers, you may contact us at the following address:

contact.ohlalapp@gmail.com